Medical Debt Collectors and Billing Vendors: Negotiating Attorney General Mandates and Defending the Breach

Jessica L. Klander, Shareholder and Chair of the Board | Bassford Remele

Jessica L. Klander advises health care organizations, hospital systems, collection agencies, creditors, and law firms on privacy, data security, and governmental and regulatory affairs, and she represents them in state and federal regulatory inquiries, civil investigative demands, and consumer lawsuits. Clients retain her as outside general counsel to run compliance audits, write and update policies and procedures, and advise on risk under the many regimes that meet in patient billing and collections, including HIPAA as it applies to privacy in patient billing, the Minnesota Attorney General Hospital Agreement, the No Surprises Act, the GLBA Safeguards Rule, the FDCPA and Regulation F, and the FCRA. She is a shareholder at Bassford Remele, co-chair of its Consumer Finance Practice Group, and the firm’s President and Chair of the Board.

• Education & Credentials

Ms. Klander received her J.D., summa cum laude, from William Mitchell College of Law in 2011. There she served as Executive Editor of Volume 38 of the William Mitchell Law Review (2010–2011) after a year as a staff member, held a Trustee Merit Scholarship, received a CALI Award, and was named to the Dean’s List from 2008 to 2011. She earned her B.A. from Macalester College in 2004.

She is admitted in Minnesota, Iowa, Missouri, and North Dakota, and before the U.S. Courts of Appeals for the Seventh, Eighth, and Eleventh Circuits and federal district courts in Minnesota, Nebraska, Arkansas, Illinois, Iowa, Michigan, Missouri, and Wisconsin. During law school she was a law clerk extern to Magistrate Judge Franklin Noel of the U.S. District Court for the District of Minnesota (2010) and a law clerk intern to the Honorable Thomas Knapp of the Seventh Judicial District (2009).

• Recognition & Leadership

Within the collections industry, Ms. Klander serves as State Compliance Chair for Minnesota (since 2021) and North Dakota (since 2024) in ACA International’s Members’ Attorney Program, sits on ACA International’s Collection Notice Review Committee and CNR Panel, holds the designation of ACA International Scholar, and served on the insideArm Legal Advisory Board from 2021 to 2026. At her firm, she serves as President and Chair of the Board.

She was the 107th President of the Hennepin County Bar Association for 2025–2026, following terms as President-Elect, Treasurer, and Secretary, and she now serves as its Past President and on the Board of Directors of the Hennepin County Bar Foundation. Her recognitions include Attorney of the Year for Outstanding Service to the Profession (Minnesota Lawyer, 2024), Top Women in Law (Minnesota Lawyer, 2025), the Minnesota Legal 250 in Business Litigation (Minnesota Lawyer, 2026), C-Level and Leadership Awards (Finance & Commerce, 2026), The Best Lawyers in America® for Professional Malpractice Law– Defendants (2025–present), and the Minnesota Super Lawyers list (2023–present), following Minnesota Rising Stars selection from 2014 to 2022.

• Professional Involvement

Ms. Klander co-hosts the “In the Alphabet Soup with Bassford Remele” webinar series on the ACA International platform, with sessions including The Safeguards Rule (2023) and Data Privacy and Cybersecurity: Past Breaches, Current Law, and Issues on the Horizon (2021). Her other presentations on health care collections and data security include Medical Debt and Credit Reporting (ACA International, 2022), Best Practices to Avoid Data Privacy and/or Cybersecurity Claims (ACA International, 2025), Critical Updates: The Impact of Recent Regulatory and Legislative Changes on Healthcare Billing and Revenue Cycle Management (Bassford Remele Health Care Seminar, 2025), The Unique Risks of Healthcare Collections and How to Address Them (ACA International, 2019), and Overview of HIPAA (Lorman Education Services, 2013). She co-authored The Basics: Why Data Security Matters (Upsize Magazine, 2023) and has written the Bassford Remele Consumer Law Defense and Risk Management E-Bulletin since 2013.

She is a member of the International Association of Privacy Professionals, the Minnesota Hospital Association, Receivables Management Association International, the National Creditors Bar Association, the Minnesota Creditors’ Rights Association, the Federal Bar Association, the Minnesota State Bar Association Consumer Law Section, the Iowa State Bar Association, and the International Association of Defense Counsel. She served as Executive Editor of PLD Quarterly for the Professional Liability Defense Federation from 2022 to 2024.

• Experience

Ms. Klander’s compliance work spans the hospital systems, collection agencies, creditors, and law firms whose compliance management systems must satisfy overlapping state and federal requirements, and she defends those same clients when regulators and consumers challenge their practices. In litigation, she obtained the Eighth Circuit decision in Hill, 888 F.3d 343 (8th Cir. 2018), holding as a matter of first impression that a materiality standard applies to deception claims under the FDCPA; secured a Seventh Circuit affirmance of dismissal of consolidated collection-letter claims for lack of Article III standing; and won reversal of a federal district court order certifying an FDCPA class. For a health care provider, she obtained a Minnesota Supreme Court ruling in Binkley, 877 N.W.2d 547 (Minn. 2016), extending immunity under the Minnesota Commitment Treatment Act to good-faith decisions not to admit a patient seeking voluntary admission. Her practice also includes defending lawyers and other professionals against malpractice and professional liability claims.

Nicholas J. Prola, Shareholder | Bassford Remele

Nicholas J. Prola defends financial entities, law firms, healthcare providers, and other organizations against consumer financial protection claims, and he counsels organizations on privacy and data security while defending the regulatory and class action claims that arise from them. For entities in the ARM industry, he acts as outside general counsel on state and federal regulatory compliance, policies and procedures, contracting, vendor management, employment issues, and litigation. He is a shareholder at Bassford Remele.

• Education & Credentials

Mr. Prola received his J.D. from the University of San Diego School of Law in 2010, where he held a University Merit Honors Scholarship, earned honors in Lawyering Skills I, Legal Research, and Writing, was named Best Oral Advocate in Lawyering Skills I (2008), served as a student delegate to the Student Affairs Committee of the Board of Trustees (2007–2008), and sat on the Phi Alpha Delta executive board for fundraising (2008–2009). He earned his B.A. from the University of Illinois in 2005.

He is admitted in Colorado and Illinois and before the U.S. District Courts for the District of Colorado, the Northern and Southern Districts of Illinois, the Northern and Southern Districts of Indiana, the Western District of Michigan, the Southern District of Texas, and the Eastern and Western Districts of Wisconsin.

• Recognition & Leadership

Mr. Prola advocates for the ARM industry at the Colorado state legislature and previously served on the Legislative Committee of the ACA of Colorado, Wyoming, and New Mexico. He serves on ACA International’s Collection Notice Review (CNR) Panel and is a past Board Member of Associated Collection Agencies, Inc.

• Professional Involvement

Mr. Prola speaks regularly to the medical billing and collections community. His presentations include An Update on Medical Debt Collection & Credit Reporting Laws and Regulations (AccountsRecovery.net, 2024); Legislation Impacting Medical Billing and Collections, Colorado and Beyond (COHAM and AAHAM Joint Annual Conference, 2024); A Closer Look at Legislation Impacting Medical Billing (Radiological Business Management Association, 2022); and, for the Healthcare Financial Management Association, The Vendor Management Rut (2018) and Patient Interactions and Payment Trends Amidst the Pandemic (2021). He has also presented on Regulation F for ACA International, including Regulation F, 108 Days Later (2022) and Incorporating Regulation F Into Your Training Program (2021), and has been a frequent AccountsRecovery.net webinar presenter since 2023, with topics including How to Establish an Effective Root Cause Analysis Program (2024) and What’s Actually Getting Companies Sued Right Now (2026).

He presented a Caselaw and Litigation Update for the Colorado Bar Association’s Collections: From Start to Finish program (2025) and is a member of the Colorado Bar Association, the Illinois State Bar Association, ACA International, Inc., and Receivables Management Association International.

Experience

Mr. Prola’s data breach work includes representing an agency in a ransomware attack that targeted nearly 2 million individuals and produced a nationwide class action. In health care collections, he obtained dismissal with prejudice for a hospital system of class-action counterclaims and crossclaims based on its chargemaster. For collection agencies, he has won dismissal of FDCPA claims for failure to state a claim, for an untimely Rule 60(b) attempt to vacate a judgment without a showing of excusable neglect, and for ineffective service of the complaint.

SESSION 1 – Understanding and Negotiating Attorney General Mandates from the Medical Debt Collector’s Side | Nicholas J. Prola & Jessica L. Klander | 2:30pm – 3:30pm

Learn how to understand and negotiate the obligations AVC No. 26-053 and its copycats push down to your medical debt collection and billing vendor clients. You will work through coverage, the 12-month clock and the termination right, and then the security terms: 16 inventory and risk rating, 17 segmentation and the shared-tenant fallback, 11 deletion against Regulation F record retention, 18 attestation and 19 penetration-test scope, and the 20 audit election. The session also covers Maryland’s void-contract noreporting clause and contingency pricing, and where covered entities actually concede ground.

BREAK | 3:30pm – 3:40pm

SESSION 2 – Defending the Breached Collection Vendor | Nicholas J. Prola & Jessica L. Klander | 3:40pm – 4:40pm

When a single breach at your vendor client reaches dozens of covered entities, learn how to sequence § 164.410 notice across the BAA portfolio while forensics are still running. You will also build the riskanalysis file and the § 160.408 financial-condition submission that OCR will test against MMG Fusion and other recent business-associate resolutions. The session closes with managing cyber coverage (retention, sublimits and consent to settle) and feeding the breach back into the BAA.